Executive brief
Appium Desktop is a desktop application used to inspect and test mobile applications. Versions 1.14.1 and earlier contain an OS command injection vulnerability that allows attackers to execute arbitrary commands on the system running Appium Desktop if its network ports are exposed to untrusted networks, potentially leading to complete system compromise.
Technical details
Appium Desktop v1.14.1 and prior is vulnerable to OS command injection (CWE-78). An attacker can send a crafted request to the application's exposed network ports to inject and execute arbitrary OS commands. No authentication or user interaction is required to exploit this vulnerability. The attack vector is network-based with low complexity. Successful exploitation allows remote code execution with the privileges of the user running Appium Desktop. The project has been archived and no fixes are planned; users are advised to migrate to Appium with Appium Inspector instead.
Affected products
- Appium Desktop 1.14.1 and prior
Timeline
- 2023-05-02: disclosed: Published on OSV and NVD
- 2023-04-25: other: Repository archived by owner